           (tk-internal/throw-app-error-if-exists!))))
     (is (true? true))))
 
+(defn validate-connection-failure
+  [f]
+  (try
+    (f)
+    (is false "Connection succeeded but should have failed")
+    (catch IOException e)
+    (catch ProtocolException e))
+  nil)
+
 (deftest test-app-startup-against-crls
   (let [test-url "https://localhost:8140/production/node/localhost"]
     (tk-bootstrap-testutils/with-app-with-config

(ns puppetlabs.master.bootstrap-test
  (:import (org.httpkit ProtocolException))
  (:require [clojure.test :refer :all]
            [puppetlabs.kitchensink.testutils :refer [with-no-jvm-shutdown-hooks]]
            [puppetlabs.master.services.config.jvm-puppet-config-service

          (is (= (:status response) 200))))
      (testing (str "Simple request to jvm puppet fails when the client "
                    "certificate's serial number is in the server's CRL.")
        (validate-connection-failure
          #(tk-webserver-testutils/http-get
            test-url
            {:ssl-cert
              "./test-resources/config/master/conf/ssl/certs/localhost-compromised.pem"
             :ssl-key
              "./test-resources/config/master/conf/ssl/private_keys/localhost-compromised.pem"
             :ssl-ca-cert
              "./test-resources/config/master/conf/ssl/certs/ca.pem"
             :keepalive 0}))))))